Open-Domain Question Answering on MS-MARCO
91AccuracyClean
Evaluation results
| Method | Links | ||||
|---|---|---|---|---|---|
| CleanModel=Llama3-8B, Defense Framework=AstuteRAG2025.05 | 91 | — | — | — | |
| CleanModel=Llama3-70B, Defense Framework=AstuteRAG2025.05 | 91 | — | — | — | |
| CleanModel=Deepseek-V3-0324, Defense Framework=InstructRAG2025.05 | 89 | — | — | — | |
| CleanModel=GPT-4, Defense Framework=AstuteRAG2025.05 | 89 | — | — | — | |
| CleanModel=Deepseek-V3-0324, Defense Framework=AstuteRAG2025.05 | 89 | — | — | — | |
| PRAGModel=GPT-4, Defense Framework=AstuteRAG2025.05 | 88 | — | 5 | — | |
| PRAGModel=Deepseek-V3-0324, Defense Framework=AstuteRAG2025.05 | 88 | — | 5 | — | |
| CleanModel=GPT-4o, Defense Framework=AstuteRAG2025.05 | 87 | — | — | — | |
| CleanModel=GPT-4, Defense Framework=InstructRAG2025.05 | 86 | — | — | — | |
| PRAGModel=GPT-4o, Defense Framework=AstuteRAG2025.05 | 86 | — | 4 | — | |
| PRAGModel=Llama3-70B, Defense Framework=AstuteRAG2025.05 | 86 | — | 9 | — | |
| HRAGModel=GPT-4, Defense Framework=AstuteRAG2025.05 | 85 | — | 8 | — | |
| HRAGModel=Deepseek-V3-0324, Defense Framework=AstuteRAG2025.05 | 85 | — | 10 | — | |
| HRAGModel=GPT-4o, Defense Framework=AstuteRAG2025.05 | 84 | — | 8 | — | |
| CleanModel=Llama3-8B, Defense Framework=InstructRAG2025.05 | 83 | — | — | — | |
| PRAGModel=Llama3-8B, Defense Framework=AstuteRAG2025.05 | 83 | — | 11 | — | |
| CleanModel=GPT-4o, Defense Framework=InstructRAG2025.05 | 82 | — | — | — | |
| PRAGModel=Deepseek-V3-0324, Defense Framework=InstructRAG2025.05 | 82 | — | 16 | — | |
| CleanModel=GPT-3.5, Defense Framework=AstuteRAG2025.05 | 82 | — | — | — | |
| AuthChainModel=Deepseek-V3-0324, Defense Framework=AstuteRAG2025.05 | 82 | — | 11 | — | |
| HRAGModel=GPT-4o, Defense Framework=InstructRAG2025.05 | 81 | — | 13 | — | |
| HRAGModel=GPT-3.5, Defense Framework=AstuteRAG2025.05 | 81 | — | 12 | — | |
| CleanModel=Llama3-70B, Defense Framework=InstructRAG2025.05 | 79 | — | — | — | |
| CleanModel=GPT-3.5, Defense Framework=InstructRAG2025.05 | 78 | — | — | — | |
| PRAGModel=GPT-4o, Defense Framework=InstructRAG2025.05 | 76 | — | 21 | — | |
| PRAGModel=GPT-3.5, Defense Framework=AstuteRAG2025.05 | 73 | — | 14 | — | |
| HRAGModel=Llama3-8B, Defense Framework=AstuteRAG2025.05 | 73 | — | 23 | — | |
| HRAGModel=Deepseek-V3-0324, Defense Framework=InstructRAG2025.05 | 72 | — | 20 | — | |
| HRAGModel=Llama3-70B, Defense Framework=InstructRAG2025.05 | 71 | — | 22 | — | |
| AuthChainModel=GPT-4o, Defense Framework=InstructRAG2025.05 | 70 | — | 25 | — | |
| AuthChainModel=Deepseek-V3-0324, Defense Framework=InstructRAG2025.05 | 69 | — | 28 | — | |
| PRAGModel=Llama3-70B, Defense Framework=InstructRAG2025.05 | 67 | — | 29 | — | |
| AuthChainModel=GPT-4o, Defense Framework=AstuteRAG2025.05 | 67 | — | 28 | — | |
| PRAGModel=GPT-4, Defense Framework=InstructRAG2025.05 | 65 | — | 30 | — | |
| CleanLLM Backbone=GPT-4o, Pipeline Configuration=Retriever-Only2026.06 | 60.01 | — | — | — | |
| AuthChainModel=Llama3-8B, Defense Framework=AstuteRAG2025.05 | 60 | — | 35 | — | |
| HRAGModel=GPT-4, Defense Framework=InstructRAG2025.05 | 59 | — | 39 | — | |
| HRAGModel=Llama3-70B, Defense Framework=AstuteRAG2025.05 | 58 | — | 39 | — | |
| AuthChainModel=GPT-4, Defense Framework=AstuteRAG2025.05 | 57 | — | 34 | — | |
| CleanLLM Backbone=LLaMA-2-7B, Pipeline Configuration=Retriever-Only2026.06 | 56.29 | — | — | — | |
| AuthChainModel=GPT-4, Defense Framework=InstructRAG2025.05 | 56 | — | 43 | — | |
| PRAGModel=Llama3-8B, Defense Framework=InstructRAG2025.05 | 56 | — | 37 | — | |
| AuthChainModel=GPT-3.5, Defense Framework=AstuteRAG2025.05 | 56 | — | 30 | — | |
| AuthChainModel=Llama3-70B, Defense Framework=AstuteRAG2025.05 | 56 | — | 37 | — | |
| CleanLLM Backbone=DeepSeek-R1, Pipeline Configuration=Retriever-Only2026.06 | 54.72 | — | — | — | |
| CleanLLM Backbone=Qwen2.5-7B, Pipeline Configuration=Retriever-Only2026.06 | 51.43 | — | — | — | |
| PRAGModel=GPT-3.5, Defense Framework=InstructRAG2025.05 | 51 | — | 40 | — | |
| AuthChainModel=Llama3-8B, Defense Framework=InstructRAG2025.05 | 51 | — | 46 | — | |
| CleanLLM Backbone=Qwen3-Max, Pipeline Configuration=Retriever-Only2026.06 | 50.23 | — | — | — | |
| AuthChainModel=Llama3-70B, Defense Framework=InstructRAG2025.05 | 50 | — | 48 | — | |
| HRAGModel=Llama3-8B, Defense Framework=InstructRAG2025.05 | 49 | — | 48 | — | |
| CleanLLM Backbone=Vicuna-7B, Pipeline Configuration=Retriever-Only2026.06 | 47.96 | — | — | — | |
| HRAGModel=GPT-3.5, Defense Framework=InstructRAG2025.05 | 47 | — | 43 | — | |
| AuthChainModel=GPT-3.5, Defense Framework=InstructRAG2025.05 | 45 | — | 46 | — | |
| PoisonedRAG-BBLLM Backbone=LLaMA-2-7B, Pipeline Configuration=Retriever-Only2026.06 | 33.95 | — | 89.72 | — | |
| PoisonedRAG-BBLLM Backbone=Vicuna-7B, Pipeline Configuration=Retriever-Only2026.06 | 30.6 | — | 90.01 | — | |
| PoisonedRAG-BBLLM Backbone=GPT-4o, Pipeline Configuration=Retriever-Only2026.06 | 30.17 | — | 85.3 | — | |
| PoisonedRAG-BBLLM Backbone=Qwen2.5-7B, Pipeline Configuration=Retriever-Only2026.06 | 28.93 | — | 83.89 | — | |
| PoisonedRAG-BBLLM Backbone=Qwen3-Max, Pipeline Configuration=Retriever-Only2026.06 | 27.62 | — | 85.54 | — | |
| The RAG ParadoxLLM Backbone=GPT-4o, Pipeline Configuration=Retriever-Only2026.06 | 27.54 | — | 89.28 | — | |
| The RAG ParadoxLLM Backbone=LLaMA-2-7B, Pipeline Configuration=Retriever-Only2026.06 | 26.39 | — | 88.92 | — | |
| PoisonedRAG-BBLLM Backbone=DeepSeek-R1, Pipeline Configuration=Retriever-Only2026.06 | 25.81 | — | 88.76 | — | |
| Joint-GCGLLM Backbone=Vicuna-7B, Pipeline Configuration=Retriever-Only2026.06 | 24.11 | — | 92.01 | — | |
| CRCPLLM Backbone=DeepSeek-R1, Pipeline Configuration=Retriever-Only2026.06 | 23.69 | — | 90.96 | — | |
| The RAG ParadoxLLM Backbone=Qwen2.5-7B, Pipeline Configuration=Retriever-Only2026.06 | 23.35 | — | 90.81 | — | |
| CRCPLLM Backbone=Qwen2.5-7B, Pipeline Configuration=Retriever-Only2026.06 | 22.58 | — | 89.74 | — | |
| Joint-GCGLLM Backbone=LLaMA-2-7B, Pipeline Configuration=Retriever-Only2026.06 | 22.28 | — | 87.65 | — | |
| Joint-GCGLLM Backbone=DeepSeek-R1, Pipeline Configuration=Retriever-Only2026.06 | 22.12 | — | 87.93 | — | |
| The RAG ParadoxLLM Backbone=Vicuna-7B, Pipeline Configuration=Retriever-Only2026.06 | 22.08 | — | 85.43 | — | |
| The RAG ParadoxLLM Backbone=DeepSeek-R1, Pipeline Configuration=Retriever-Only2026.06 | 21.6 | — | 93.25 | — | |
| The RAG ParadoxLLM Backbone=Qwen3-Max, Pipeline Configuration=Retriever-Only2026.06 | 21.14 | — | 90.66 | — | |
| CRCPLLM Backbone=LLaMA-2-7B, Pipeline Configuration=Retriever-Only2026.06 | 20.97 | — | 90.71 | — | |
| Joint-GCGLLM Backbone=GPT-4o, Pipeline Configuration=Retriever-Only2026.06 | 20.78 | — | 90.1 | — | |
| CRCPLLM Backbone=Vicuna-7B, Pipeline Configuration=Retriever-Only2026.06 | 20.12 | — | 90.56 | — | |
| CRCPLLM Backbone=Qwen3-Max, Pipeline Configuration=Retriever-Only2026.06 | 20.11 | — | 92.85 | — | |
| CRCPLLM Backbone=GPT-4o, Pipeline Configuration=Retriever-Only2026.06 | 19.9 | — | 90.07 | — | |
| Joint-GCGLLM Backbone=Qwen3-Max, Pipeline Configuration=Retriever-Only2026.06 | 19.85 | — | 90.26 | — | |
| Joint-GCGLLM Backbone=Qwen2.5-7B, Pipeline Configuration=Retriever-Only2026.06 | 19.5 | — | 91.78 | — | |
| ARAMBackbone=LLaDA-8B-Instruct2026.03 | — | 20 | — | 2.5 | |
| ARAMBackbone=Dream-v0-Instruct-7B2026.03 | — | 18 | — | 3.3 | |
| ATACompressor2026.03 | — | 53.3 | — | — | |
| Corpus PoisoningRetriever=SPECTER2025.12 | — | 96 | 96.39 | — | |
| DreamBackbone=Dream-v0-Instruct-7B2026.03 | — | 11 | — | 1.9 | |
| Dream + A-CFGBackbone=Dream-v0-Instruct-7B2026.03 | — | 17.4 | — | 2.6 | |
| Dream + ADACADBackbone=Dream-v0-Instruct-7B2026.03 | — | 21.7 | — | 2.9 | |
| Dream + CADBackbone=Dream-v0-Instruct-7B2026.03 | — | 20.9 | — | 1.7 | |
| Dream + COIECDBackbone=Dream-v0-Instruct-7B2026.03 | — | 21.7 | — | 2.7 | |
| Dream + RAGBackbone=Dream-v0-Instruct-7B2026.03 | — | 17.5 | — | 2.8 | |
| Dream + SPREADBackbone=Dream-v0-Instruct-7B2026.03 | — | 17.8 | — | 2.9 | |
| EmoRAGRetriever=SPECTER2025.12 | — | 98 | 99.98 | — | |
| GCG AttackRetriever=SPECTER2025.12 | — | 0 | 1.13 | — | |
| LLaDABackbone=LLaDA-8B-Instruct2026.03 | — | 9.7 | — | 1.1 | |
| LLaDA + A-CFGBackbone=LLaDA-8B-Instruct2026.03 | — | 24.5 | — | 1.4 | |
| LLaDA + ADACADBackbone=LLaDA-8B-Instruct2026.03 | — | 14.3 | — | 1.2 | |
| LLaDA + CADBackbone=LLaDA-8B-Instruct2026.03 | — | 24.7 | — | 0.4 | |
| LLaDA + COIECDBackbone=LLaDA-8B-Instruct2026.03 | — | 25.4 | — | 0.9 | |
| LLaDA + RAGBackbone=LLaDA-8B-Instruct2026.03 | — | 25.6 | — | 1.4 | |
| LLaDA + SPREADBackbone=LLaDA-8B-Instruct2026.03 | — | 25.2 | — | 1.7 | |
| LLaMABackbone=LLaMA-3.1-8B-Instruct2026.03 | — | 14.7 | — | 1.4 | |
| LLaMA + RAGBackbone=LLaMA-3.1-8B-Instruct2026.03 | — | 19 | — | 2.4 |